WordPress core get_page_template path traversal enables unauthenticated RCE
Path traversal in WordPress core's get_page_template() enables unauthenticated local PHP file inclusion and conditional RCE. Actively exploited within 24 hours of disclosure. CVSS 8.1 High.
- Vendor
- WordPress
- Product
- WordPress Core
- CVSS
- 8.1
- EPSS (exploit probability)
- 95.8%
- Status
- kev
- CISA patch-by (BOD 22-01)
- Published
Is CVE-2026-87902 being exploited?
Yes. CISA added CVE-2026-87902 to its Known Exploited Vulnerabilities catalog on . CISA only lists a CVE when it has reliable evidence of exploitation in the wild. It is also listed in ENISA's EU Vulnerability Database (EUVD) exploited list.
FIRST's EPSS model puts the probability of exploitation activity in the next 30 days at 95.8% (scored October 25, 2026).
- CISA KEV[ LISTED ]
- ENISA EUVD (exploited)[ LISTED ]
- CIRCL KEV[ — ]
Catalog snapshot 2026-11-13. Full cross-catalog view: /kev-comparison
CVE-2026-87902 timeline
Every event links to its source. Catalog dates are each catalog's own; day offsets count from NVD publication. Data: JSON
What to do
US federal civilian agencies must remediate by (3 days after listing) under BOD 22-01. Everyone else: that deadline is a sensible upper bound, not a target. Vendor guidance and the NVD record are linked under Source above.
CVE-2026-87902 is a path traversal vulnerability in WordPress core’s page-template resolution mechanism. Per NVD, published September 22, 2026: an unauthenticated attacker can manipulate how get_page_template() resolves page templates, causing it to include a chosen readable local .php file from outside the active theme directories. Remote code execution is possible when specific preconditions at both the server and active theme are met. Those preconditions are not fully specified in the public NVD record.
Exploitation status
Active exploitation confirmed. BleepingComputer reported September 23, 2026 that attackers moved from reconnaissance to writing files to disk that execute shell commands when accessed. Exploitation began within 24 hours of the public advisory. SecurityWeek independently confirmed exploitation started immediately after disclosure.
CVSS note
NVD assigns CVSS 8.1 High. Some outlets reported a vendor-side score of 9.8 Critical. The 8.1 score reflects the conditional RCE path: reaching code execution requires specific server and active-theme conditions to align.
Patch
A WordPress core fix is available, per SecurityWeek. Auto-update-enabled installs should have received it automatically.
Full coverage: WordPress Core RCE Flaw CVE-2026-87902 Under Active Exploit.
Other WordPress Core CVEs we track
| CVE / Vulnerability | Severity | CVSS | EPSS | Added to KEV |
|---|---|---|---|---|
| CVE-2026-119977 WordPress WordPress Core Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability | [ HIGH ] | 8.1 | 1.2% | |
| CVE-2026-63030 WordPress Core unauthenticated RCE (wp2shell)write-up | [ CRITICAL ] | 9.8 | 10.6% | |
| CVE-2026-60137 WordPress WP_Query author__not_in SQL injection (wp2shell companion)write-up | [ MEDIUM ] | 5.9 | 5.3% |
